What this site collects.

Information you send us

The engagement request form on the contact page collects your name, work email address, company, the service you are interested in, an optional website or application URL, optional timing, and your scope summary. Submitting the form stores those values, the time of submission, and a token used to recognise a repeated submission.

The quote request form on the pricing page collects your name, company, email address, a plain-text description of the domain or scope, the engagement and request type you choose, and an optional objective. It stores those values, the time of submission, a random token used to recognise a repeated submission, and the status of our internal notification. The scope description is stored as text: we do not visit, fetch or test anything you enter.

Nothing else on this site collects information from you. There are no other forms, no account system, no file uploads and no comment fields.

Why we hold it

To reply to your enquiry and to scope an engagement. Your submission is stored in our database so it is not lost. A contact-page submission is also sent to us as an email notification; quote request notifications are not yet switched on, so those are read from the database. Neither is used for marketing lists, sold, or shared with anyone beyond the service providers listed below.

Abuse control

To stop the form being used to send bulk traffic, the server counts submissions per connection inside a short time window. It does this using a salted, one-way hash of your network address. The address itself is not stored and not written to logs, the hash is not linked to your submission, and the counter is only meaningful for the length of its own window.

The quote request form applies two limits: attempts per connection, and accepted requests per email address. Both are counted under keyed one-way hashes (HMAC) made with a secret held only on the server, so neither your network address nor your email address is stored in the counter. Counter rows carry an expiry and are deleted after it passes.

Our hosting and database providers keep their own operational logs under their own terms, as any web host does.

Who processes it

• VercelHosts the website and runs the form endpoint.
• NeonProvides the Postgres database where submissions are stored.
• ResendDelivers the email notification of a contact-page submission to us. Quote requests are not sent to Resend.

What this site does not do

• No analytics, advertising pixels or third-party trackers.
• No cookies set by this site, and no cookie banner, because there is nothing to consent to.
• No embedded chat widget, booking tool or newsletter signup.
• No fingerprinting, session recording or heatmaps.

Engagement data is separate

This page covers the website only. Data handled during a testing engagement — evidence, findings and reports — is governed by the master services agreement and the statement of work for that engagement. How engagement material is handled.